Why Not All Password Managers are Secure and What to Do About It